July 29, 2026

SHARE |

A String of ISIS-Inspired Attacks in Europe

(AP Photo/Markus Schreiber)

In Europe, a sudden uptick in arrests, thwarted plots, and executed attacks — some believed to be connected with the Islamic State (IS) or aligned with Iran — have sparked a debate about the state and effectiveness of European counterterrorism monitoring, intelligence-collection, and interdiction capabilities. In the last week alone, an arrest of a pro-IS teenager in Italy, a thwarted attack on a synagogue, a young man with an extensive criminal record’s attack on a festival Germany, and a stabbing spree in France, have taken place. While some of these cases were successfully thwarted, indicating the effectiveness of tip-offs and monitoring, successful attacks have sparked a debate about prevention strategies.

On July 20, Italian authorities arrested a teenage girl in Pavia on international terrorism charges, identifying concerning social media patterns that aligned with IS. Italy’s cyber police and counterterrorism authorities had collected intelligence over months on the individual, sharing that she had participated in pro-IS Telegram chats, shared IS propaganda on social media platforms, and even downloaded instructions about building explosive weapons.

On July 25, French law enforcement conducted a raid that resulted in the arrests of six members of a cell that planned a now foiled attack against a synagogue in Sarcelles, just outside Paris, resulting in the evacuation of over 300 town residents after police received a tip-off. French police have not attributed an exact terrorist network to the attack but have stated that the plot was tied to “Islamic extremism.” Similar plots against Jewish community sites have been flagged elsewhere in Europe and North America, particularly since the outbreak of the Iran War. Some networks have even been associated with Iran-backed militia networks such as Kataib Hezbollah or criminal networks like Foxtrot.

That same day as the attack was foiled in Sarcelles, there was a major attack during Berlin’s Christopher Street Day and Pride Parade festivities. The perpetrator was a German citizen of Lebanese descent, Abdul Ballout. Ballout’s cellular device was found to contain a self-recorded video, recorded the day of the Christopher Street Day attack, pledging allegiance to IS before carrying out a car-ramming and stabbing operation that killed at least one individual and injured 31 others.

Two days later on July 27, a suspect went on a stabbing spree in Paris’ 17^th district, using kitchen knives to stab three women, aged 19, 24, and 36. One of the victims was severely wounded, while another one was pregnant. The attacker was stopped by an off-duty police officer and several bystanders who rushed to pin him to the ground, throwing suitcases and cafe chairs to subdue him. The July 27 stabbing attack has created widespread discourse, particularly surrounding the French government’s delay in deciding whether to investigate the stabbings as a terrorist attack. A video clip of the arrest, recorded by an onlooker, has sparked debate over whether the attack had terrorist intent: as an off-duty police officer tackled the stabber to the ground, the attacker reportedly made statements “it is Allah who commanded me” and “Allah sent me to kill women.” The video has prompted some to perceive the attack as an Islamist-inspired incident, akin to previous attacks perpetrated by IS militants in Europe in the mid and late 2010s. Yet the French government has hinted that they are undecided over whether to open an investigation under the national anti-terrorist prosecutor’s office. France’s interior minister Laurent Nunez has stated that the suspect was making “incoherent statements,” and that “we must obviously remain very cautious regarding the motives behind this extremely violent act.”

In Germany, a different debate has arisen after the Christopher Street Day and Pride festival attacks, concentrating on the effectiveness of German and international prevention methods. While only 21 years old, the attacker, Ballout, had an extensive criminal history with extensive evidence of alignment with IS ideology, having engaged in assault and extortion. He even attempted to enter Syria twice through Türkiye, then Lebanon, to meet with IS operatives. Ballout served out two prison sentences, one in Lebanon for just three months after attempting to travel to Syria in 2025, along with serving just under two years in a German juvenile detention center from 2025 to May 2026. He was then released on probation by German authorities to participate in a rehabilitation program for deradicalization, though reportedly he attended few sessions, carrying out this attack in Berlin just months after release. DW reported that the attacker’s phone was wiretapped but was not “subject to comprehensive surveillance.”

Ballout’s strong history of radicalization and proclivity for violence has raised questions about the German government’s — particularly the judiciary’s — counterterrorism approach, where abridged sentencing may not serve as a one-size-fits-all solution for individuals that demonstrate repeated intent for terrorist activity. Expert Adrian Shtuni noted that “ ... The gap between the known risk and this lenient handling is hard to reconcile with basic public-safety priorities ... Treating a person who had already shown intent and action toward joining ISIS mainly as a youth-rehabilitation case raises serious questions.”

The twin attacks have also reignited calls for an EU-wide intelligence collection effort that registers high-risk terrorist actors. Currently, intelligence and security agencies monitoring terrorist actors remain at the national level, shaped by their own domestic legal regulations on surveillance and monitoring. While European countries operate different national lists, the metrics regarding risk matrix, extremist levels, and other important data, differ, complicating exchange and coordination efforts. There are new calls for an EU-wide mechanism that facilitates intelligence-sharing and an expansion of national watchlists for individuals considered high-priority threats for terrorist incidents.

Collectively, the debates around these separate attacks have given rise to voices across the political spectrum calling for restricted immigration and harsh approaches towards Muslim communities. Germany’s far-right party, Alternative for Germany (AfD) have criticized the handling of Ballout’s detention and probation, requesting the expansion of comprehensive surveillance on “Islamist security threats” — a list maintained by German intelligence that includes at least 420 to 470 individuals considered to be high-level risks. AfD’s spokesman, Martin Hess, stated “If an Islamist ‘threat actor’ known to the police was able to commit such an act, there must be a thorough investigation into why he was able to move about freely in the first place.” French politician Marine Le Pen referenced both attacks in Paris and Berlin, accusing Macron’s government of sweeping “the dust under the rug to avoid naming the evil” and issuing statements such as “eradicating Islamism is a daily battle” and “the Islamist threat has never been more present.” As European counterterrorism agencies seek to adopt new strategies to prevent and interdict terrorist plots, it is likely that far-right candidates will also double down on Islamophobic policy approaches that may not address the root causes of radicalization and succeed in preventing attacks.

Though, already, these attacks and plots have inspired early signs of reform. In Germany, the Federal Minister of the Interior Alexander Dobrindt has stated that the government has begun a review process that may reassess suspended sentences in cases where suspects have repeated intent for violence and/or have strong alignment with terrorist organizations. This could lead to an extension of prison sentences for those convicted of terrorism charges in a country where sentences are short, compared to European neighbors. Authorities are also exploring how they can expand monitoring of high-risk individuals without overwhelming law enforcement authorities, measures that will likely require further investment in counterterrorism agencies and capacity in the long-term.